Httpd – how to know which domain is using which apache instance

As mentioned by the previous answer, looking at a specific Apache process doesn't have a lot of value.

I might suggest that you should alter your httpd.conf settings - either using more efficient processes (e.g. PHP-FPM instead of mod_php) or altering the number of servers/clients/requests).

Typically, in an environment with multiple domains, each domain gets it own user. (This is typically seen if you are running PHP in FastCGI mode, and makes it easy to see which PHP process is using significant resources).

The following is simply for interest sake - it serves little useful purpose in this case:

Should you really want to determine what site a particular process is serving at any given instant, you could run a trace looking for file access. Be advised however, that significant quantities of output will generated very rapidly on a high traffic server.

For instance, the following will show file opens (typically only .htaccess files if you use FastCGI), as well as directory listings, and is enough to identify which domain the process is serving right now:

strace -p PID -e trace=open,lstat64

Example Output:

Process PID attached - interrupt to quit
open("/path/to/website/folder/.htaccess", O_RDONLY|O_LARGEFIL     E|O_CLOEXEC) = 66
open("/path/to/website/folder/subfolder/.htaccess", O_RDONLY|O     _LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
lstat64("/path", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat64("/path/to", {st_mode=S_IFDIR|0755, st_size=90, ...}) = 0
lstat64("/path/to/website", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat64("/path/to/website/folder", {st_mode=S_IFDIR|0755, st_size=4096, .     ..}) = 0
lstat64("/path/to/website/folder/subfolder", {st_mode=S_IFDIR|0750, st_size     =21, ...}) = 0
lstat64("/path/to/website/folder/subfolder/php.fcgi", {st_mode=S_IFREG|0750     , st_size=96, ...}) = 0

Alternatively, you can look at the process reads, and grep for 'Host':

strace -p PID -e trace=read -s 100 2>&1 | grep "Host:"

Example Output:

read(65, "GET /path/of/request/ HTTP/1.0\r\nHost: www.domain.com\r\nX-Real-IP: xxx.xxx.xxx.xx"..., 8000) = 1167

(You might need to make the 'string length' (s) value longer)

Once again, keep in mind that both of these are an 'instant in time' look at what a given process is serving - in the next instant that will change - it is therefore useless for anything beyond curiosity.